fix(artifacts): record initial publication receipts atomically

[Open-Squilla]

Problem and change

Concurrent first publications of one generated HTML source can interleave after the first document is created but before its publication receipt is saved. A later publication advances the document, then the first publication reapplies its older snapshot, producing A → B → A and reverting the current head.

Record the initial publication receipt in the existing transaction that creates the initial revision and binds the source. A delayed continuation then recognizes the completed occurrence and preserves the newer head. Add deterministic interleaving coverage for identical and changed publications, including repeated delivery of both events.

The attachment replay regression now uses a fixed synthetic attachment ID. Random tokens can accidentally contain a complaint-routing marker and change providers independently of image replay. The archive-read, gate-call, provider-call, and image-content assertions remain intact.

• Target: main.
• Linked issue: None. Refs fix(scheduler): reject past one-time 'at' cron schedules #1526, whose CI exposed this existing main-branch race.
• Scope: Generated artifact adoption and its existing publication receipt, plus a deterministic identifier in the attachment replay regression; no schema migration or new lock.
• Release note: Bug fix; prevent concurrent generated document publications from reverting newer content. No version change.
• Safety/platform notes: Platform-neutral database transaction change. Existing source validation, session scope, and artifact checks remain in place. Tests use synthetic local HTML and no credentials or network services.
• Third-party origin: Original repository implementation; no external code copied. This follow-up is independent of the contributor's scheduler change in fix(scheduler): reject past one-time 'at' cron schedules #1526.

Validation

• Deterministic regression against main 14087d9ce: 1 failed, 3 passed; failure demonstrates the extra revision and old-content replay.
• Original failing test file after the fix: 40 passed.
• ArtifactSession, generated source continuity, and workbench resource tests: 145 passed.
• Ruff, targeted mypy on all four changed source files, and git diff --check: passed.
• Attachment-history E2E file after the deterministic identifier and main synchronization: 17 passed. Controlled main/head runs with a complaint-marker token reproduce the unrelated provider-switch failure while confirming zero image blocks and no archive replay.
• Full cross-platform acceptance runs in GitHub CI.

[github-actions]

Merge queue CI: success — run 35097224143, attempt 1.
Tested queue candidate: baad7903d563199d0a77f6ad06a554098ad05a6b. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 35101508769, attempt 1.
Tested queue candidate: afde529ee588a3cbc55fec8b31de2c3071714d59. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.